ON
Vendor
onnx
15
CVEs
0
On KEV
4
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-115922 New | ON onnx onnx | 6.2 | Oct 26 | ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs |
| CVE-2026-115921 New | ON onnx onnx | 6.2 | Oct 26 | ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute |
| CVE-2026-115920 New | ON onnx onnx | 6.2 | Oct 26 | ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank |
| CVE-2026-115919 New | ON onnx onnx | 6.2 | Oct 26 | ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check) |
| CVE-2026-49114 | ON ONNX ONNX | 7.1 | Aug 21 | ONNX symlink-following and path-traversal arbitrary file write |
| CVE-2026-63632 | ON onnx onnx | 3.3 | Aug 18 | ONNX: Heap-Buffer-Overflow READ in Gemm Version Converter Adapter via Undersized Input Shape |
| CVE-2026-44512 | ON onnx onnx | 5.5 | Jul 8 | ONNX: Null Pointer Dereference in Upsample Version Converter Adapter (Zero Inputs) |
| CVE-2026-14647 | ON onnx Onnx | 4.3 | Jul 4 | onnx onnxruntime old.cc convPoolShapeInference_opset19 out-of-bounds |
| CVE-2026-11329 | ON onnx-mlir onnx | 3.6 | Jun 5 | onnx onnx-mlir Placeholder Node Cache backend.py generate_hash_key weak hash |
| CVE-2026-34447 | ON onnx onnx | 5.5 | Apr 1 | ONNX: External Data Symlink Traversal |
| CVE-2026-34446 | ON onnx onnx | 5.5 | Apr 1 | ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load |
| CVE-2026-27489 | ON onnx onnx | 7.5 | Apr 1 | ONNX: Path Traversal via Symlink |
| CVE-2026-34445 | ON onnx onnx | 8.6 | Apr 1 | ONNX: Malicious ONNX models can crash servers by exploiting unprotected object settings. |
| CVE-2026-28500 | ON onnx onnx | 9.1 | Mar 18 | ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack |
| CVE-2024-7776 | ON Onnx Onnx | 9.1 | Mar 20 | A vulnerability in the `download_model` function of the onnx/onnx framework, before and including version 1.16.1, allows for arbitrary file overwrite due to inadequate prevention… |